AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.9.1 - Unauthenticated Stored Cross-Site Scripting via File Upload
- ID
- WPSEC-2026-2716
- Plugin
- AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (ai-engine)
- Affected
- all versions before 3.9.2
- Remediation
- Update to 3.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini on WPSec AttackSurface
- Fix released
- Published
Description
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads (the chatbot and AI Forms upload endpoint /mwai-ui/v1/files/upload and the Public API simpleFileUpload endpoint) in all versions up to, and including, 3.9.1, due to insufficient validation of the uploaded file's content. The upload endpoint accepted any file with an audio extension (such as .flac) even when WordPress's content check had rejected it, and the shared upload routine checked only the filename's extension before copying the file into the public uploads folder. This makes it possible for unauthenticated attackers, on any page that shows a chatbot or form, and authenticated users through the Public API, to upload HTML files disguised as audio that run arbitrary scripts when a user opens the file's URL. Exploitation requires a web server that sends no media type for the extension used, so that the browser renders the file as HTML.
References
- https://wpsec.com/vuln/WPSEC-2026-2716/
- https://plugins.svn.wordpress.org/ai-engine/tags/3.9.2/
- https://wordpress.org/plugins/ai-engine/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS